Volatility, financial instability and the pace of technological change has consumers, investors and regulators demanding greater visibility into what organisations are doing. In this increasingly complex environment, organisations need Internal Audit to take on a broader role.

In May 2013, EY commissioned Forbes Insights to conduct a global survey and Chief Audit Executive (CAE) interviews focused on Internal Audit’s shifting mandate within the organisation. More than 500 CAEs and audit committee members participated, spanning 20 industries.

Stakeholders are demanding more of Internal Audit every day

External auditors are increasingly relying on the work of Internal Audit

Shareholders are demanding greater assurance of financial controls

Regulators are scrutinizing companies around an ever changing environment

Increasing competency requirements

As Internal Audit’s mandate expands and its scope increases, the function needs to be prepared to fulfil additional skills and competency requirements. At present, many Internal Audit functions may not be ready.

For example, although more than half of respondents indicate that they will be need to be more heavily involved in identifying, assessing and monitoring emerging risks over the next two years, there appears to be a disconnect in the skills and competencies they feel their internal auditors should have. When we asked respondents which skills they believe are most important for their Internal Audit staff to possess, their top five skills were compliance-focused: financial audit and accounting; internal controls; operational audit; compliance and regulatory; and risk management. Data analytics ranked 6th, fraud prevention and detection 9th, business strategy 10th and deep industry experience 12th.

And yet, when we asked respondents to rank which skills or knowledge their internal auditors were lacking, respondents ranked data analytics, business strategy, deep industry experience, risk management, and fraud prevention and detection as their top five. These skills are crucial if Internal Audit is shifting its mandate to a strategic advisor. Of equal interest given the technology challenges that Internal Audit is handling, when we asked respondents which areas they outsource to third-party providers, 43% indicate specialised IT skills.

Internal Audit functions need to shift competency and training efforts to ensure they have the right skills to meet audit plan requirements and management expectations.

Right person, right place, right job

Having a robust people model is a core element of a well-balanced internal audit strategy. The people model should focus on developing and deploying resources, defining competencies and training, and sharing knowledge.

Ultimately, there are three building blocks to a successful people management system:

The organisational structure determines whether Internal Audit is centralized, decentralized or a hybrid.

Individual competencies need to match the organisational structure. Any skills gaps identified need to be addressed.

Role charters / job descriptions facilitate execution. They centre around what activities each level in the function is expected to perform.

Soft skills are fast becoming as important as purely technical auditing skills. To be a strategic advisor to the business, auditors need to be able to think critically, apply business knowledge and clearly articulate insights to management. Auditors need to adjust training and think outside the box to ensure that it has the right people with the right skills and competencies in its Internal Audit function.

Corporate leaders are demanding that Internal Audit improve visibility across the enterprise and provide strategic insights that can deliver lasting value for the organisation. Internal auditors need to ensure they have the right people, in the right place at the right time to meet these expectations. Otherwise, the business will leave them behind.

Connect with us

Stay connected with us through social media, email alerts or webcasts. Or download our EY Insights app for mobile devices.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.